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Ladies and Gentlemen: 

This comment letter is submitted on behalf of Coinbase, Inc. (" Coinbase ") in response to 
the Department's proposed BitLicense rule reflected in the notice appearing at 2014-15 N.Y. St. 
Reg. 14 (" Proposed Rule "). 

Coinbase is a Delaware corporation, formed in May 2012, with its principal office in San 
Francisco, California. Coinbase offers a suite of services which are designed to make it easy for 
the average consumer or business to use Bitcoin, including: (i) a Bitcoin exchange service, 
whereby users can buy and sell Bitcoins in transactions with Coinbase; (ii) a hosted solution 
which allows users to track and manage their own Bitcoins through the Coinbase website or 
mobile application; and (iii) a suite of technological tools for merchants that accept Bitcoin as a 
method of payment. 

Coinbase would like to thank the Department for its thoughtful proposal and for the 
opportunity to comment on the Proposed Rule. We recognize that drafting proposed rules for the 
financial services industry is a difficult undertaking in and of itself; doing so in the context of 
Virtual Currencies is even more so. Coinbase supports the regulation of Virtual Currency 
Business Activity as we believe it will benefit consumers and continue to drive greater choice, 
product enhancements, and innovation in the Virtual Currency ecosystem. 

We have a few comments on the general impact of the Proposed Rule and the BitLicense 
construct, which are followed by comments on specific provisions in the Proposed Rule. 

A. Impact of the Proposed Rule 

Certain of the recordkeeping and anti-money laundering requirements set forth 
under the Proposed Rule would effectively eliminate the utility of the core feature of 
Bitcoin and other cryptocurrencies - their open protocol - and thus the ability to innovate 
through the use of such virtual currencies. Hence, in lieu of imposing these requirements, 
the Department should treat licensees in the same manner as money transmitters and 
simply require them to comply with the federal Bank Secrecy Act. The Department should 
likewise narrow the scope of the Proposed Rule to exclude the myriad of non-financial 
services uses for the distributed ledger component of virtual currencies. Finally, the 
Department should implement a framework which fosters the development of new virtual 
currency offerings without imposing overwhelming regulatory burdens, and apply a tiered 
approach to capital and surety bonds requirements. 

As a general matter, the portions of the Proposed Rule that we find most difficult are 
those recordkeeping and anti-money laundering requirements that go above and beyond the 
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obligations imposed under New York's money transmission statute and the federal Bank Secrecy 
Act. These additional recordkeeping and anti-money laundering requirements are likely to impact 
the industry in a way that is inconsistent with the goal articulated in the Department's press 
release announcing the issuance of the Proposed Rule: "We have sought to strike an appropriate 
balance that helps protect consumers and root out illegal activity - without stifling beneficial 
innovation." 1 

Perhaps the greatest feature of Bitcoin, as well as other cryptocurrencies, is the fact that 
it utilizes an open protocol which enables an interoperable, freely accessible open network. As 
such, it is possible for a wide range of network participants to develop and utilize different 
solutions — such as near instantaneous and free remittances, micro-transactions, or other 
distributed recordkeeping uses — that are capable of worldwide interoperability so long as they are 
based on the same open protocol. However, by imposing certain of the recordkeeping and anti- 
money laundering requirements, which require the collection of information not supported by the 
protocol (such as the names, account numbers, and physical address of all parties to a 
transaction), and go far beyond what is required of money transmitters under New York law, as 
well as under the federal Bank Secrecy Act, the Proposed Rule would force licensees to operate 
closed, proprietary payment networks (similar to Visa or PayPal), effectively eliminating the utility 
of this feature and thus stifling innovation. Additionally, licensees should not be prohibited from 
engaging in Virtual Currency Business Activities in conjunction with an unlicensed entity where 
the licensee takes on all obligations of the Virtual Currency Business Activity and it is clear that 
the licensee is engaging in the Virtual Currency Business Activities with the customers. 
Otherwise, licensees will be unable to leverage the vast number of potential integration 
opportunities available to them, which would significantly - and unnecessarily - limit the potential 
growth of the industry and have a detrimental impact on innovation. 

Moreover, the scope of activity captured by the definition of "Virtual Currency Business 
Activity" would impose regulation upon a host of non-financial services businesses in a way that 
is unnecessary and thus should be restricted. The distributed ledger at the core of many virtual 
currencies allows for inexpensive, reliable, and public recordkeeping which can be utilized in a 
myriad of innovative ways. Newly-developing technologies built upon this invention include: (i) 
tools which allow users to prove the existence of documents (e.g., contracts, wills and 
testaments, interests in property) at specific points in time; (ii) the ability for individuals to digitally 
"sign" and timestamp works of digital art; (iii) cryptographically activated physical property, the 
ownership or transfer of which may be recorded in the distributed ledger; (iv) a decentralized data 
storage and communications network where participants are incentivized to contribute storage 
capacity, computing power, or content through peer-to-peer micro-transactions; and (v) an open 
and transparent voting system. These technologies, and many others like them, may rely on the 
receipt and transmission of Virtual Currency as a means of transmitting information to a 
distributed ledger. Under the Proposed Rule, however, such receipt and transmission may well 
require a BitLicense, creating an unnecessary barrier for thousands of small companies or 
inventors that wish to contribute to these non-financial uses of distributed record systems, and 
thus stifling innovation. 

Finally, the Department should foster innovation by implementing a framework which 
permits emerging companies to develop and offer new Virtual Currency products and services 
within established volume and/or other thresholds without first having to undergo the burden of 
the full application and licensing process, and then to continue operating while pursuing licensure 
once those thresholds have been met. Absent such a framework, the vast majority of new 
companies will face insurmountable barriers to entry that will prevent them from participating in 
the market, thus eliminating an enormous percentage of potential innovation and restricting 
competition that would otherwise be greatly beneficial for consumers. More specifically, we 



1 New York State Department of Financial Services, "NY DFS Releases Proposed BitLicense 
Regulatory Framework for Virtual Currency Firms" (Press Release, July 17, 2014), available at: 
http://www.dfs.ny.gov/about/press2014/pr1407171.html. 
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would estimate that at least 90% of new companies with potentially viable concepts for Virtual 
Currency products and services would be unable to develop and bring those concepts to market 
in the event that they are first required to undergo the full licensing process. 

B. Comment on the BitLicense Construct 

To eliminate inefficiency, excess expense for the Department and licensees, the 
redundancy associated with two application processes, complying with two similar but 
distinct licensing regimes, establishing and staffing two different divisions within the 
Department, and the need to subject licensees to potentially two different examinations 
covering very similar regulatory obligations, Coinbase is of the view that Virtual Currency 
Business Activity would be better regulated under New York's existing Money 
Transmission statute than under a separate BitLicense regime. 

Many companies that will engage in Virtual Currency Business Activity will likewise 
engage in activities involving fiat currency-denominated products and services which, given our 
understanding of the Proposed Rule, would fall within the scope of New York's money 
transmission statute rather than the Proposed Rule. Hence, these entities would have to acquire 
both a BitLicense and a money transmission license from the Department in order to do so. 2 

If we understand the interrelationship of the Proposed Rule and New York's money 
transmission statute correctly, then an entity engaged in both Virtual Currency Business Activity 
and money transmission will be subject to the following duplicative obligations: 

• File separate but similar applications for a BitLicense and a money 
transmission license; 

• Provide biographical, financial and fingerprinting information for the same 
subset of personnel; 3 

• Acquire a surety bond for the BitLicense and a surety bond for money 
transmission license; 

• Meet the capital requirements under the Proposed Rule and the money 
transmission statute; 4 

• Maintain separate Permissible Investment obligations for what is the same 
business; 

• Meet separate reporting obligations for what is the same business; and 

• Be subjected to separate examinations for what is the same business. 

It is also our understanding that BitLicensees will be licensed by, and supervised by, a 
different division or different staff within the Department than the division or persons that license 
and supervise money transmitter licensees. As a practical matter, it will be costly and time- 



2 For example, a Virtual Currency company could engage in the exchange of Virtual Currency 
into fiat currency which the user could then remit to a third party. It is our understanding that the 
remittance of fiat currency would constitute money transmission and thus require that entity to 
become licensed as a money transmitter. 

3 Additionally, all employees of a BitLicensee would need to submit fingerprints to the 
Department. See Section B(3)(a) below. 

4 It is unclear to us how the Department would view the capital issue. Would, for example, the 
Department require an entity licensed as a BitLicensee and a money transmitter to meet two 
different capital obligations by segregating capital? Would any capital used to meet one of the 
licensing regimes be available to meet the capital requirement of the other regime? 
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consuming to deal with separate staff within the Department in the operation of what is one 
business. For example, an entity with both a BitLicense and a NY money transmitter license will 
need to interact with separate Department personnel on identical issues (e.g. notice of a material 
change in the business plan of the entity). It also seems to us that this duplicity may create 
inefficiencies within the Department as personnel, rather than relying on their own knowledge of 
the workings of licensed money transmitters and BitLicensees would have to step across the 
hallway, so to speak, to ask questions of a different staff or division who is regulating the same 
entity for exactly the same business activity. 

Given the relatively nascent stage of the Virtual Currency ecosystem, there remains 
substantial regulatory uncertainty with respect to Virtual Currency Business Activity at the federal 
and state level. This regulatory uncertainty exacts a price on Virtual Currency businesses when 
they are negotiating with potential banking partners and business partners. Adding additional 
ambiguity around whether a Virtual Currency entity needs to be licensed as BitLicensee or a 
money transmitter or both serves to add to the issue. This is true both for the licensee that is 
seeking to explain its business to potential partners doing diligence on it, as well as the licensee 
that is doing appropriate due diligence on potential partners to ensure that the licensee is not 
facilitating unlicensed activity. With respect to the latter, while this will likely be a difficult enough 
task where one licensing regimes applies, adding a second will, given the uncertainty surrounding 
the characterization of certain activities, likely require licensees to engage in a comprehensive 
and costly analysis of each potential partner's business so as to properly determine which regime 
applies to each activity and confirm that the partner maintains all required licenses and underlying 
authorizations/approvals. 

In our view, the Department could eliminate the duplicity, inefficiency, redundancies, and 
ambiguity arising out of crafting a BitLicense construct outside of its money transmission statute 
by simply amending its money transmission regulations to add definitions for Virtual Currency and 
Virtual Currency Business Activity. The Department could likewise subject, by further 
amendment of the NY money transmission regulations, those money transmission licensees 
engaged in Virtual Currency Business Activity to those additional obligations placed upon 
BitLicensees pursuant to the Proposed Rule (e.g. cybersecurity). Specifically, we are of the view 
that Section 302(a) of New York's Financial Services Law provides the Superintendent with all of 
the power necessary to regulate Virtual Currency Business Activity under New York's existing 
money transmission statute: 

302. Regulations by Superintendent. 

(a) The Superintendent shall have the power to prescribe and from time to time 
withdraw or amend, in writing, rules and regulations and issue orders and 
guidance involving financial products and services, not inconsistent with the 
provisions of this chapter, the banking law, the insurance law, and any other law 
in which the superintendent is given authority: 

(1) effectuating any power given to the superintendent under the 
provisions of this chapter, the insurance law, the banking law, or any other law to 
prescribe forms or make regulations: 

(2) interpreting the provisions of this chapter, the insurance law, the 
banking law, or any other applicable law; and 

(3) governing the procedures to be followed in the practice of the 
department. 

Further, Section 649 of New York's money transmission statute likewise clearly empowers the 
Superintendent to issue and amend regulations implementing the money transmission statute: 
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649. Rules and Regulations. 

The Superintendent is hereby authorized and empowered to make such 
rules and regulations as may in his judgment be necessary or appropriate for the 
enforcement of this article. 

We recognize that a gating issue for the Department with respect to this approach may 
be the term "money" as used in the provision setting forth the licensing requirement under the 
money transmission statute, which reads as follows: "No person shall engage in the business 
of receiving money for transmission or transmitting the same, without a license therefor obtained 
from the superintendent as provided in this article ." Section 641 (1 ). Similarly, Section 406.1 of 
the NYCRR states that "[f\his part contains regulations relating to the transmission of money by 
licensees and their agents under Article Xlll-B of the Banking Law. For purposes of this Part, the 
business of transmission of money will be divided into three categories: the issuance and sale of 
travelers checks to the public, the sale and issuance of money orders to the public, and the 
transmission of money on behalf of the public by any and all means or manner including but not 
limited to transmissions within this country or to locations abroad by wire, check, draft, facsimile 
or courier." 

There is not a definition of "money" in either the New York money transmission statute or 
in the implementing regulations, such that the Department has, by virtue of the Superintendent's 
broad interpretive powers, the ability to make its own determination as to what this term should 
cover. 5 

We believe the Department has the power to regulate certain financial uses of Virtual 
Currency under its money transmission statute, could interpret the term "money" to allow for the 
same, and such a regulatory construct would work to the benefit of the Department, entities 
engaged in Virtual Currency Business Activity and money transmission, and the residents and 
consumers of the state of New York. 

B. Coinbase's Principal Comments to the Proposed Rule 

1. Section 200.2(n) - Definition of "Virtual Currency Business Activity" 

(a) In order to provide greater clarity with respect to activity where certain security 
features, such as multi-signature technology, are utilized, the "securing, storing, holding, or 
maintaining custody or control of Virtual Currency " element of "Virtual Currency Business 
Activity" should be replaced with "maintaining control of Virtual Currency on behalf of others" . 

The presence of features such as multi-signature technology make what is meant 
by "securing, storing, holding, or maintaining custody or controf of virtual currency less than 



5 Certain court decisions support a broad definition of money - see e.g., Klauber v. Biggerstaff , 3 
N.W. 357, 359 (Wis. 1986)("Money is a generic and comprehensive term. It is not a synonym of 
coin. It includes coin, but is not confined to it. It includes whatever is lawfully and actually current 
in buying and selling of the value and as the equivalent of coin."); Borie v. Trott , 5 Phila. 366, 403 
(Pa. 1863)("Money;'s any matter, whether metal, paper, beads, shells, rocks, etc. which has 
currency as medium of commerce"); De Biase v. Commercial Union Ins. Co. , 53 Misc. 2d 45, 46 
(N.Y. Civ. Ct. 1967)(citing Richard v. American Union Bank , 253 N.Y. 166 (N.Y. 1930)) 
{"Nonetheless, if some broad use of the word 'money' is to be acknowledged, it is as any 
commodity having a means of exchange, as sheep, as wampum, copper rings, quills of salt, 
shovel blades, tobacco, gold, etc. By itself then, money is but a device having value between 
those who use it"). Thus, such decisions could provide a basis for viewing Virtual Currency as 
something that constitutes, or could, over time, evolve into something that would constitute, 
"money". 
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clear. To explain, multi-signature technology, which provides users with heightened virtual 
currency controls, involves associating a single public key with multiple private keys and requires 
the use of a certain subset of the associated private keys (e.g., 3 of 5) in order to initiate a 
transfer from the public key. Where such technology is used, although the provider might hold 
one or more of the associated private keys, it would not be capable of initiating a transfer from the 
public key without the requisite private keys, and thus would not possess control of the 
associated virtual currency. Hence, in order to provide clarity and ensure that this element of 
"Virtual Currency Business Activity" is appropriately tailored to exclude the simple provision of 
such beneficial technology, the Department should revise it to only cover instances where one 
controls (;'.e., has the ability to transfer) Virtual Currency on behalf of others. 

(b) The scope of Virtual Currency Business Activity should exclude non-financial 
activity involving Virtual Currency so as to avoid imposing unnecessary regulation upon those 
companies and inventors wishing to utilize the unique elements of the virtual currencies protocols 
- namely, the distributed ledgers - for non-financial purposes . 

As further discussed in Section A above, the distributed ledgers that reside at the 
core of many virtual currencies can be utilized by a wide range of emerging technologies which 
are unrelated to financial services. Although these technologies may rely upon the receipt and 
transmission of Virtual Currency as a means of transmitting information to a distributed ledger, 
the Department should, given its focus on financial products and services, exclude such activity 
from the definition of "Virtual Currency Business Activity," and thus avoid unnecessarily requiring 
thousands of small companies or inventors to obtain a license in order to contribute to these non- 
financial uses of distributed record systems. 

(c) The Department should clarify that, to the extent that a licensee is engaged in 
Virtual Currency Business Activity as well as activity that does not fall within the definition of 
"Virtual Currency Business Activity," the scope of the licensee's obligations under the final rule 
shall be limited to its Virtual Currency Business Activity . 

Although the Department has made this clear in certain provisions (e.g., the 
books and records provision in 200.12, which requires licensees to, "in connection with [the 
licensee's] Virtual Currency Business Activity, make, keep and preserve all of its books and 
records"), it is unclear in others (e.g., the material change provisions in Section 200.10, the 
provisions dealing with anti-money laundering and cyber security in Sections 200.15 and 200.16, 
the business continuity and disaster recover provisions in Section 200.17, the advertising and 
consumer disclosure provisions in Sections 200.18 and 200.19, and the provisions dealing with 
complaints in Section 200.20). Therefore, the Department should include a general statement, or 
revise all such provisions to clarify, that the scope of each obligation is limited to the licensee's 
Virtual Currency Business Activity, such that they do not extend to capture the licensee's 
activities which are not regulated by the final rule. 

2. Section 200.3(b) - Unlicensed Agents Prohibited. "Each Licensee is prohibited from 
conducting any Virtual Currency Business Activity through an agent or agency arrangement when 
the agent is not a Licensee." 

The scope of this provision appears unclear, and therefore the Department should clarify 
that this (i) simply prohibits a licensee from extending agency to an unlicensed entity so as to 
allow the unlicensed entity to engage in Virtual Currency Business Activity on behalf of the 
licensee (much in the same manner as money transmitters engage and operate through 
authorized agents), and (ii) does not prohibit a licensee from engaging in Virtual Currency 
Business Activities in conjunction with an unlicensed entity where the licensee takes on all 
obligations of the Virtual Currency Business Activity and it is clear that the licensee is engaging in 
the Virtual Currency Business Activities with the customers. 
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3. Section 200.4 - Application 

(a) The Department should not require all individuals employed by the applicant to 
provide a set of fingerprints and two portrait-style photographs in connection with the application . 

This requirement exceeds that which is imposed upon New York chartered 
depository institutions and licensed money transmitters. Therefore, the Department should 
instead mirror the requirements currently imposed upon applicants for money transmitter 
licenses, such that biographical information, background reports and fingerprints are only 
required for each natural person who is a director, principal officer or 10% equity security owner 
of any entity seeking licensure. 

(b) The obligation to provide copies of written policies and procedures in connection 
with the initial application should be limited to a specific list so as to provide applicants with clarity 
as to what is expected in terms of such documentation . 

In lieu of the broad requirement to provide "all written policies and procedures, 
including those required by this Part", it is more appropriate to require applicants to provide 
copies of those written policies and procedures which are specifically identified in the other 
portions of the Rule, namely, those related to anti-fraud, anti-money laundering, cyber-security, 
privacy and information security, recordkeeping, business continuity and disaster recovery, and 
complaints. 6 

4. Section 200.8 - Capital requirements 

The restrictions imposed with respect to a licensee's investment of its retained earnings 
and profits are overly broad and unnecessary, and thus should either be eliminated in their 
entirety or, alternatively, applied only to those amounts comprising the minimum capital required 
to be maintained by the licensee . 

Generally speaking, licensed money transmitters have an obligation to maintain 
permissible investments in an amount equal to their outstanding money transmission obligations 
(i.e., for each dollar that a licensee receives from a customer it is obligated to maintain a dollar, 
either in cash or in one of the other items specified as a "permissible investment" under the 
money transmission statute). As (i) the Proposed Rule provides a similar requirement in Section 
200.9 related to the maintenance of Virtual Currency of the same type and amount as the 
licensee is obligated to provide, (ii) we understand that those entities wishing to engage in 
activities covered by the money transmission statute will need to obtain a money transmission 
license and comply with the requirements under that statute in connection with that activity, and 
(iii) each licensee will be subject to minimum surety bond and capital requirements, imposing 
additional restrictions on the manner in which a licensee may invest its additional capital is overly 
broad, unnecessary and goes beyond the requirements imposed upon money transmitters. 
Further, as noted above, licensees will not be operating on a fractional reserve basis, such that it 
would be inappropriate to apply bank-like requirements to licensees. If the Department were to 
nevertheless seek to impose such restrictions, they should be limited in their application to the 
minimum capital amounts that the licensee is required to maintain, and should not extend to 
capital in excess of such amounts. Otherwise, such obligations would effectively prohibit a 
licensee from investing in Virtual Currency, purchasing another company, making capital 
expenditures, or otherwise deploying its excess capital to grow its business. 



6 Of course, the Department would still maintain its authority under Section 200.4(a)(14) to 
require and obtain additional documentation, which it could exercise on a case-by-case basis 
while at the same time providing some level of certainty as to the basic documentation 
requirements applicable to all applicants. 
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5. Section 200.9 - Custody and protection of customer assets 

(a) In order to provide greater clarity where certain security features, such as multi- 
signature technology, are utilized, a licensee's obligation to hold virtual currency under Section 
200.9(b) should only apply in the event, and to the extent, that the licensee maintains control of 
virtual currency on behalf of another person . 

While the general concept of maintaining virtual currency of the same type and 
amount as the licensee is obligated to provide is entirely appropriate, as further discussed in 
Section B(1)(a) above, the presence of features such as multi-signature technology make what is 
meant by "secures, stores, holds or maintains custody of virtual currency in connection with this 
requirement less than clear. Hence, in order to provide clarity and ensure that the maintenance 
obligations correspond to the virtual currency that the licensee has access to, it is more 
appropriate to require a licensee to maintain virtual currency of the same type and amount as that 
which it controls (;'.e., has the ability to transfer) on behalf of others. 

(b) Section 200.9(c), which provides that "\e]ach Licensee is prohibited from selling, 
transferring, assigning, lending, hypothecating, pledging, or otherwise using or encumbering 
assets, including Virtual Currency, held, stored, or maintained by, or under the custody or control 
of, such Licensee on behalf of another Person" , should be limited to prohibiting licensees from 
executing a change of control over, or encumbering (e.g., granting a security interest to a third 
party), any Virtual Currency that they may hold on behalf of customers . 

As currently written, this provision seems to prevent a licensee from doing certain 
things that it may be obligated to do on behalf of customers (e.g., selling or transferring Virtual 
Currency as instructed by the relevant customer) and duplicate (albeit in a different way) the 
requirement that the licensee hold Virtual Currency of the same type and amount that it is 
obligated to provide to its customers (by virtue of its prohibition on selling, transferring or using 
the Virtual Currency, in which case the licensee would no longer be fulfilling its maintenance 
obligation). Hence, it should be revised to clarify that it is simply limited to prohibiting licensees 
from executing a change of control over, or encumbering (e.g., granting a security interest to a 
third party), any Virtual Currency that they may hold on behalf of customers without 
corresponding customer permissions and/or instructions. Further, while the maintenance 
obligation in Section 200.9(b) seems to treat Virtual Currency as fungible, the language in this 
provision does not, and thus should be revised to clarify that Virtual Currency is indeed fungible. 

6. Section 200.10 - Material change to business 

(a) A licensee's obligation with respect to a material change (including the 
introduction of a new product, service or activity) should be limited to providing notice of the 
change to the Department, rather than obtaining the Department's prior written approval of the 
change. 

The obligation for a licensee to obtain the Department's prior written approval of 
any material change would, given the level of consideration and analysis that will likely be 
required in order for the Department to issue such approval, significantly impair the licensee's 
ability to respond to changes in the competitive landscape and otherwise have a stifling effect on 
innovation. This issue would be further compounded by the fact that it would not take long for the 
Department to become overwhelmed with such requests for approval. Therefore, it is more 
appropriate, and consistent with the requirements and practices employed in connection with 
licensed money transmitters, to require licensees to provide notice of such changes rather than 
obtain prior written approval from the Department. 

(b) A "material change" that would trigger the notice obligation should be limited to 
that which varies in a material respect from the information contained in the licensee's application 
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or any subsequent additions or revisions thereto (e.g., a new product or service which is 
materially different from those previously described). 

In addition to those changes which cause a product, service or activity to be 
materially different from that previously disclosed in the licensee's application, the scope of 
"material change" set forth under the Proposed Rule includes those which (i) "may raise a legal or 
regulatory issue about the permissibility of the product, service, or activity and (ii) "may raise 
safety and soundness or operational concerns." Given the lack of clarity regarding what the latter 
two categories may encompass, and the many unresolved questions with respect to virtual 
currencies, nearly any change could arguably be fit within one of these two categories either prior 
to implementation or post-implementation. Hence, a licensee would likely be compelled to submit 
virtually all changes to the Department in order to avoid the possibility of being cited for a violation 
even where the proposed change does not seem to fit within either of the latter two categories 
prior to implementation. Putting aside the debilitating operational burden that this would impose 
upon licensees, it would result in a flood of correspondence to be reviewed by the Department 
even under a notice regime, and place a stranglehold on a licensee's operations (and the 
industry) under a prior approval regime. Therefore, it is far more appropriate, and consistent with 
the requirements and practices employed in connection with licensed money transmitters, to limit 
what constitutes a reportable "material change" to that which causes a product, service or activity 
to be materially different from that previously disclosed in the licensee's application or any 
subsequent additions or revisions thereto. 

7. Section 200.11 - Change of control; mergers and acquisitions 

The definition of "control" should mirror that set forth under the money transmitter statute, 
and therefore the threshold utilized with respect to the presumption of control should be 25% 
instead of 10% . " "" " ' ^ 

Section 200.1 1 (a)(2) provides that "Control shall be presumed to exist if a Person, 
directly or indirectly, owns, controls, or holds with power to vote ten percent or more of the voting 
stock of a Licensee or of any Person that owns, controls, or holds with power to vote ten percent 
or more of the voting stock of such Licensee." The money transmitter statute contains a nearly 
identical provision, with the sole difference being that it employs a threshold of 25% rather than 
10%. 7 Given the regulatory burden imposed upon the acquirer in connection with a change of 
control transaction, this difference would place licensees on an un-level playing field with money 
transmitters in terms of their ability to attract potential investors, and therefore, this provision 
should be revised to utilize the same 25% threshold employed under the money transmitter 
statute. 

8. Section 200.12 - Books and records 

(a) Licensees should be required to maintain their books and records for such time 
as may be required by law or in accordance with generally accepted accounting principles . 

The Proposed Rule's records retention period of 10 years, which broadly applies 
to all of a licensee's books and records, is unnecessarily long and burdensome, and should be 
replaced by a more flexible standard that requires licensees to apply different retention periods 



7 See NY CLS Bank § 652-a(1)(" Control shall be presumed to exist if any person directly or 
indirectly, owns, controls, or holds with power to vote twenty-five per centum or more of the voting 
stock of any licensee or of any person which owns, controls or holds with power to vote twenty- 
five per centum or more of the voting stock of such licensee, but no person shall be deemed to 
control a licensee solely by reason of his being an officer or director of such licensee or 
person. ..")(emphasis added). 
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which are consistent with their relevant obligations under various laws (e.g., the federal Bank 
Secrecy Act) or as otherwise dictated by generally accepted accounting principles. 

(b) In lieu of requiring licensees to maintain the names, account numbers, and 
physical addresses of all parties to each transaction, licensees should be required to comply 
with the federal Bank Secrecy Act and its implementing regulations (and in accordance with the 
transaction thresholds set forth therein) . 

The federal Bank Secrecy Act and its implementing regulations (collectively, 
the " BSA ") set forth a well-developed and tailored approach to data collection in connection with 
transactions processed by all money services businesses (" MSBs "), including those engaged in 
virtual currency activity. The obligation to maintain the names, account numbers, and physical 
addresses of all parties to each transaction would unnecessarily eliminate the risk-based 
approach to customer identification required of MSBs under the BSA, as well as the transaction 
thresholds under the same, placing licensees on unequal footing with money transmitters and 
banks, and thus impose an undue burden on licensees without any significant corresponding 
benefit. Given the nature of virtual currency networks, a licensee may only have access to this 
information for one of the two parties to a transaction (i.e., its customer), and only be able to 
collect it for the other party to the extent that its customer possesses the information and 
provides it. For example, if a customer wished to use virtual currency to purchase something 
from an online merchant, the customer may very well not have the physical address or other 
required information for the merchant, and thus would not be able to provide it to the licensee. 
Moreover, such data collection is not supported by the network protocols, and thus the 
requirement would, as further discussed in Section A above, require licensees to operate 
outside of the protocol in a way that is highly unlikely to be interoperable with other participants 
in the network and otherwise forces them to operate closed, proprietary payment networks. 

(c) As all licensees will be required to comply with applicable law, including 
New York's Abandoned Property Law, the recordkeeping reguirements related to the 
Abandoned Property Law are unnecessary and should be removed . 

While the Department certainly has the jurisdiction, from a safety and 
soundness perspective, to examine whether a licensee is acting in compliance with all other 
applicable laws, including the Abandoned Property Law, the Proposed Rule's inclusion of 
recordkeeping reguirements for purposes of compliance with such laws is duplicative and 
could potentially result in inconsistent obligations. Therefore, it is more appropriate to 
simply reguire licensees to comply with the relevant reguirements as they are set forth 
under the other laws, including the Abandoned Property Law, and eliminate the additional 
reguirements under the final rule. 

9. Section 200. 14 - Reports and financial disclosures 

(a) The annual financial statement reguirements should mirror those applicable to 
money transmitters and other financial institutions, and thus should not include the compliance 
assessment by the licensee's management . 

The obligation for licensees to include with their annual financial statements an 
assessment by management of the licensee's compliance with all laws, rules and regulations 
applicable to it, and management's conclusion as to whether the licensee has complied with the 
same, is not reguired of money transmitters or any other financial institution. Further, such a 
report would necessarily be extremely comprehensive and thus unduly burdensome and 
expensive, and would likely be of little value to the Department, which will otherwise conduct its 
own assessment as part of its independent examination of the licensee and receive a copy of the 
licensee's independent review conducted in accordance with the BSA as well as other reviews 
reguired under the Proposed Rule. Therefore, this obligation should be removed in its entirety or, 
alternatively, replaced with an obligation, similar to that imposed with respect to securities filings, 
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to include a discussion (rather than an assessment) of material laws applicable to the licensee's 
business. 

(b) The quarterly financial statement requirements should mirror those applicable to 
money transmitters, and thus should be limited to the information required in Section 
200.14(a)(1). " "~ 

The information required in Section 200.14(a)(3)-(5) is generally unclear, not the 
sort of information typically found in financial statements, and not otherwise required of money 
transmitters. This is particularly true with respect to (a)(3), which requires the inclusion of 
"financial projections and strategic business plans", which, in addition to being vague, seems to 
go far beyond the already extensive reporting requirement applicable to material changes. 
Hence, these items should be removed from the elements required to be present in each 
quarterly financial statement. Finally, if the Department will require each licensee to provide a 
statement of its compliance with the Proposed Rule's financial requirements, it should clarify what 
such statement is to contain and perhaps provide a model form to licensees. 

10. 200. 15 - Anti-money laundering program 

(a) As it has done with money transmitters, the Department should, in lieu of 
imposing additional anti-money laundering requirements, require each licensee to comply with the 
federal Bank Secrecy Act and its implementing regulations . 

The BSA sets forth a well-developed and comprehensive anti-money 
laundering/counter-terrorist financing regime which applies to all financial institutions across the 
country, including those MSBs engaged in virtual currency activity. By imposing additional state- 
specific rules rather than simply enforcing compliance with the existing federal regime, as it does 
with money transmitters, the Department would place licensees on an un-level playing field with 
other financial institutions, create opportunities for licensees to be subject to a host of inconsistent 
obligations between the BSA and the Proposed Rule, as well as from state to state, and 
otherwise potentially face liability under other laws as a result of compliance with the Proposed 
Rule. For example, the Proposed Rule requires licensees that are not required to file Suspicious 
Activity Reports (" SARs ") under federal law to file similar information with the Department. While 
the BSA affords MSBs with protection from liability to those persons identified in any SARs they 
may file, and permits MSBs to share SARs with agencies such as the Department, no such 
protection exists under the BSA for entities that are not MSBs. In other words, there is no safe 
harbor for entities not subject to the BSA that choose (or are compelled by statute or rulemaking) 
to file SARs. Likewise, the Proposed Rule contains no such protection, and even if it did, it is 
unclear whether such protection would operate to shield the licensee from liability under federal 
law or the laws of another state to the extent a claim is brought under such laws. Moreover, the 
imposition of additional state-specific requirements will create tremendous barriers to innovation 
and perhaps even lead to conflicts with the policies and goals of FinCEN, and thus place 
licensees in an untenable position. Finally, as more fully discussed in Section A and the 
comments to Section 200.12 above, the recordkeeping and customer identification requirements 
would obligate licensees to collect information that is not supported by the network protocols, and 
thus would (i) force licensees to operate closed, proprietary payment network, (ii) eliminate the 
primary benefit of the open protocol utilized by Bitcoin and other cryptocurrencies, and (iii) stifle 
innovation. Therefore, the Department should eliminate the additional requirements related to 
anti-money laundering and instead require licensees to comply with the BSA and enforce the 
same. 

(b) Section 200.15(f), which provides that "\n]o Licensee shall engage in, facilitate, or 
knowingly allow the transfer or transmission of Virtual Currency when such action will obfuscate 
the identity of an individual customer or counterpart]/' , should be removed as it is unclear, 
potentially inconsistent with the privacy obligations imposed upon licensees, and otherwise 
adequately addressed through a licensee's separate federal obligations to implement an anti- 
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money laundering/counter-terrorist financing program, monitor and report suspicious activity, and 
comply with OFAC regulations . 

Given (i) the lack of clarity as to what this prohibition is intended to mean, how it 
is to be reconciled with (A) what a licensee will need to do in order to properly discharge its 
privacy obligations under federal and state law and (B) what is technically feasible in terms of 
network protocols, and (ii) each licensee's federal obligations to develop and implement a 
program designed to prevent money laundering and terrorist financing, monitor and report 
suspicious activity, and comply with OFAC regulations, this prohibition should be removed. 

1 1. Section 200. 16- Cyber security program 

(a) The cyber security audit requirements should provide guidelines for conducting 
an audit of compliance with the procedures and requirements set forth in the licensee's cyber 
security policy, rather than imposing specific requirements which may or may not be applicable to 
each licensee. Additionally, the record retention period of 10 years is unnecessarily long and 
should be reduced to a period more in line with the retention periods set forth under other 
requirements, such as 5 years. 

As each licensee's audit should be tailored to examine the specific issues and 
requirements addressed by its cyber security policy, the Department should establish audit 
guidelines in much the same manner as it has done for the cyber security policy requirement, 
rather than imposing specific requirements which may or may not be applicable to each licensee 
(e.g., enclosing hardware in locked cages). 

(b) The source code review requirement should be removed as it is unclear, 
unnecessary in light of the other cyber security requirements, and would potentially expose the 
licensee to additional security risks . 

As it appears in the Proposed Rule, the source code review requirement does 
not specify the purpose of the review, what steps are to be performed by the third party 
conducting the review, what standards or requirements the third party is to review the source 
code against, or any other parameters or requirements applicable to the review. However, even if 
such parameters and requirements were established, each of the other cyber security 
requirements are sufficient to ensure that proper measures are being employed by the licensee, 
such that the review requirement is unnecessary and would simply subject the licensee to 
additional security risks by virtue of allowing a third party to access its source code. In addition, 
given the emerging nature of virtual currencies as well as the varied nature of each licensee's 
systems, it is uncertain whether or to what extent any independent, qualified third parties might be 
available to conduct such reviews. For each of these reasons, the source code review 
requirement should be removed. 

12. Section 200.18(b) - Advertising and marketing. 

The retention requirement applicable to "advertising and marketing materials" should be 
limited to publicly available materials which are used to market or promote a licensee's products 
or services to customers and potential customers . 

This provision should be revised to clarify that it only applies to publicly available 
marketing materials created by or on behalf of the licensee, and does not include materials such 
as private presentations or other materials which are not used to promote the licensee's products 
or services to customers and/or potential customers. 
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13. Section 200.19 - Consumer protection 

(a) The requirement for a licensee to provide customers with a disclosure of risks 
should be limited to a specific set of model disclosures, such as those set forth in Section 200.19 
of the Proposed Rule, and should not include an obligation for the licensee to provide a list of "all 
materials risks associated with its products, services and activities and Virtual Currency 
penerally" . 

The requirement for a licensee to provide each of its customers with a 
disclosure of "all materials risks associated with its products, services and activities and Virtual 
Currency generally is unclear, overly broad, and would effectively require licensees to provide a 
comprehensive description of "risk factors" that is akin to what one might find in a securities 
registration statement. Such a disclosure would necessarily need to be updated on an ongoing 
basis, creating an enormous burden on each licensee both in terms of time and expense. 
Moreover, licensees would be compelled to make such disclosures overly inclusive in order to 
attempt to avoid missing any details, and even then would remain open to potential litigation and 
enforcement action. As such an obligation is not required of any money transmitter or other 
financial institution, it is far more appropriate and workable for the Department to promulgate a 
specific set of risks, similar to those set forth in the Proposed Rule, for licensees to disclose to 
their customers. 

(b) The requirement for a licensee to provide its customers with a disclosure setting 
forth the licensee's liability to its customers under any applicable federal or state laws, rules or 
regulations should be significantly narrowed or eliminated in its entirety . 

Similar to the requirement to provide customers with a comprehensive 
disclosure of material risks, this requirement is unclear, extremely broad, and would necessarily 
need to be updated on an ongoing basis, creating an undue burden on each licensee both in 
terms of time and expense. Given the sweeping scope of the requirement, the only way for a 
licensee to comply would be to provide an expansive treatise on all of the various provisions 
which are potentially applicable, including an explanation of any exclusions, case law and other 
interpretations which may impact the licensee's liability under certain provisions. Accordingly, 
this requirement, which is not applicable to money transmitters or other financial institutions, 
either needs to be significantly narrowed or eliminated in its entirety. 

(c) As all licensees will be required to comply with the various provisions of the 
federal Gramm-Leach-Blilely Act and its implementing regulations, as well as all applicable state 
privacy laws and regulations, the requirements related to the disclosure of customer account 
information are unnecessary and should be removed . 

As "financial institutions" under the federal Gramm-Leach-Bliley Act and its 
implementing regulations (collectively, " GLB "), licensees will be subject to a well-established set 
of disclosure and other requirements related to the use, disclosure and safeguarding of 
customer information, as well as any additional requirements under any applicable state privacy 
laws and regulations. Therefore, in lieu of imposing any similar privacy-related requirements, 
the Department should simply require licensees to comply with all applicable federal and state 
privacy laws and regulations, including, without limitation, the privacy policy disclosure 
requirements applicable under GLB. 

(d) The obligation for a licensee to provide all terms and conditions applicable to a 
transaction in connection with each transaction should be bifurcated, with licensees obligated to 
provide each customer with (i) a set of its terms and conditions/user agreement upon 
establishment of the relationship and in connection with any changes thereto, and (ii) a receipt 
containing transaction-specific details at the time of each transaction . 
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The requirement to provide all terms and conditions applicable to a transaction 
should be clarified and bi-furcated between the provision of (i) the terms and conditions 
generally applicable to the relationship or use of the customer's account, and (ii) the details 
specific to the transaction (e.g. , the amount and any transaction or other fees assessed in 
connection with the particular transaction). Otherwise, each licensee would be obligated to 
provide a combined disclosure comprised of its entire user agreement and any transaction- 
specific requirements with each transaction, which is unduly burdensome, of little benefit to the 
customer, and not something that is required of money transmitters or banks. 

(e) A licensee's obligation to disclose general terms and conditions should not 
include the items set forth in Section 20Q.19(b)(5)-(7), as they are either unnecessarily duplicative 
of other disclosure obligations or require disclosure of customer rights which are not established 
elsewhere in the Proposed Rule . 

The obligation under 200.19(b)(6) to disclose "the customer's right to receive a 
receipt, trade ticket, or other evidence of a transaction" is unnecessary given the absolute 
obligation under 200.19(e) for a licensee to provide a detailed receipt in connection with each 
transaction, and therefore should be removed. Further, as the Proposed Rule does not establish 
any rights for customers to receive periodic account statements and valuations from the licensee, 
or receive prior notice of a change in the licensee's rules or policies, the related disclosure 
obligations under 200.19(b)(5) and (7) are potentially inapplicable, may cause customer 
confusion, and thus should be removed. 

(f) The obligation for a licensee to ensure that all required disclosures are 
acknowledged as received by customers is unclear, overly broad, not required of money 
transmitters or any other financial institution, and thus should be removed . 

This requirement lacks clarity with respect to how and where such 
acknowledgements are to be obtained, goes far beyond the requirements of similar regulatory 
regimes, such as the Remittance Transfer Rule promulgated by the Consumer Financial 
Protection Bureau, and is otherwise not applicable to money transmitters or any other financial 
institution. Moreover, it is unnecessary in light of the obligation imposed upon each licensee to 
provide all required disclosures in a clear and conspicuous manner and, therefore, should be 
removed. 

(g) Section 200.19(g) , which states that "Licensees are prohibited from engaging in 
fraudulent activity and customers of Licensees that are victims of fraud shall be entitled to claim 
compensation from any trust account, bond, or insurance policy maintained by the Licensee", fails 
to set forth any framework, limits or requirements for substantiating fraud claims or claiming 
compensation, such that it could potentially require licensees to provide compensation in 
connection with a wide range of fraud claims which may be unsupported by the underlying facts 
or arise through no fault of the licensee, and thus should be removed . 

This requirement fails to provide any clarity with respect to a wide range of 
associated questions, such as (i) how the overall claims process should operate, (ii) whether the 
compensable claims are limited to those associated with fraudulent activity on the part of the 
licensee, (iii) whether the licensee is obligated to compensate customers that are the victims of 
fraudulent activities of a third party and, if so, to what extent and under what circumstances, (iv) 
whether the customer needs to prove the fraudulent activity and resulting damages in a court of 
law in order to collection compensation from the licensee, and (v) whether the licensee's 
obligations are limited to actual damages incurred by the customer as a result of the fraudulent 
activity. Absent absolute clarity on these and other related questions, this requirement could 
impose an insufferable economic burden upon licensees, and thus create significant safety and 
soundness risks for licensees. Hence, this obligation should be removed, and the Department 
should instead rely upon the existing body of law applicable to fraudulent activity and related 
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compensation, as well as each licensee's development and implementation of dispute resolution 
frameworks which are tailored to their respective businesses. 

14. Section 200.20 - Complaints 

Licensee should only be required to report changes to their complaint policies or 
procedures which would render them materially different from those policies and procedures 
previously provided to the Department . 

For the same reasons as discussed in Section 4(b) above with respect to material 
changes generally, the notice obligation with respect to changes in a licensee's complaint 
policies or procedures should be limited to those which would render them materially different 
from those policies and procedures previously provided to the Department, rather than any 
change to such policies or procedures. 



In closing, we understand the difficulty faced by the Department in developing a 
framework for the regulation of Virtual Currencies in a manner which takes into account the 
various participants, complexities and concerns involved, and respectfully request that the 
Department consider the points discussed above in its development of the final rule. Coinbase 
remains committed to collaborating with and assisting the Department and other authorities in 
their efforts to regulate Virtual Currency Business Activity, and we would greatly appreciate the 
opportunity to meet with the Department to discuss any questions or concerns regarding this 
comment letter. 



Regards, 

& — : 




Fred Ehrsam 

President and Co-Founder 
Coinbase 



cc: Chris Daniel, Paul Hastings LLP 

Todd Beauchamp, Paul Hastings LLP 



